On second thought... Reading access.log it appears the order of things aren't consistent. Sometimes Referrer comes before DNT, other times after, there is also the possibility no Referrer was logged (not even a "-").

Seems it's better to use "LogFormat = extended" in hiawatha.conf and use this instead: